Fear, Uncertainty, and the Digital Armageddon - Defcon

110 Pages·2008·2.96 MB·English

by  Marquis Boire

SCADA
Fear, Uncertainty, and the Digital Armageddon
Presented By Morgan Marquis-Boire
© 2008 Security-Assessment.com
Whois
(cid:1) Hi, My Name is Morgan
© 2007 Security-Assessment.com
Whois
(cid:1) Hi, My Name is Morgan
(cid:1) I’m a security guy
© 2007 Security-Assessment.com
Whois
(cid:1) Hi, My Name is Morgan
(cid:1) I’m a security guy
(cid:1) Security-Assessment.com
© 2007 Security-Assessment.com
Introduction
(cid:1) Security-Assessment.com
(cid:1) Independent security consultancy; no sales, no products, no
fixing the things we break
(cid:1) NZ’s largest & most experienced security team
(cid:1) Experienced with large, critical networks
(cid:1) Banks, airlines, government, telco and utility
(cid:1) Paid to think like hackers, and break things like hackers
© 2007 Security-Assessment.com
Introduction
(cid:1) So What’s a SCADA and where can I get one?
(cid:1) What is it?
(cid:1) Why is it so hip right now?
© 2007 Security-Assessment.com
SCADA Basics
(cid:1) SCADA - Supervisory Control and Data Acquisition
(cid:1) There is a tendency by the media to refer to all industrial
control systems (ICS) as SCADA
© 2007 Security-Assessment.com
SCADA Basics
(cid:1) SCADA - Supervisory Control and Data Acquisition
(cid:1) There is a tendency by the media to refer to all industrial
control systems (ICS) as SCADA
(cid:1) SCADA systems support processes that manage water supply
and treatment plants
(cid:1) Electrical power distribution
and transmission
(cid:1) Operate chemical and nuclear power
plants
(cid:1) HVAC systems – Heating,
Ventilation, Air Conditioning
(cid:1) Traffic Signals
(cid:1) Mass transit systems
(cid:1) Et al.
© 2007 Security-Assessment.com
Some History
(cid:1) Real World Examples
(cid:1) Accident
(cid:1) Worm Outbreak
(cid:1) Sabotage
(cid:1) Disgruntled Ex-employee
(cid:1) These sound familiar?
© 2007 Security-Assessment.com
I was promised some FUD
(cid:1) When Good SCADA Goes SERIOUSLY WRONG
(cid:1) “About 3:28 p.m., Pacific daylight time, on June 10, 1999, a 16-
inch-diameter steel pipeline owned by Olympic Pipe Line
Company ruptured and released about 237,000 gallons of
gasoline into a creek that flowed through Whatcom Falls Park in
Bellingham, Washington. About 1.5 hours after the rupture, the
gasoline ignited and burned approximately 1.5 miles along the
creek. Two 10-year-old boys and an 18-year-old young man
died as a result of the accident. Eight additional injuries were
documented. A single-family residence and the city of
Bellingham's water treatment plant were severely damaged. As
of January 2002, Olympic estimated that total property
damages were at least $45 million.”
© 2007 Security-Assessment.com